CVE-2022-31126: Unauthenticated Remote Code Execution in Roxy-wi

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 52.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-07-06 · updated 2026-06-17
Weakness: CWE-74

Description

Roxy-wi is an open source web interface for managing Haproxy, Nginx, Apache and Keepalived servers. A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. This affects Roxy-wi versions before 6.1.1.0. Users are advised to upgrade. There are no known workarounds for this issue.

Affected products

roxy-wi: before 6.1.1.0 — fixed in 6.1.1.0

How to fix

Upgrade to a fixed version: roxy-wi 6.1.1.0. Check the vendor advisory for mitigations.

References

https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9
https://github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9

Get alerted when CVE-2022-31126 or the next vulnerability affects your stack